diff --git a/machines/compute01/k-radius/module.nix b/machines/compute01/k-radius/module.nix
index 9c3e721..cd30e6b 100644
--- a/machines/compute01/k-radius/module.nix
+++ b/machines/compute01/k-radius/module.nix
@@ -5,11 +5,10 @@ let
 
   settingsFormat = pkgs.formats.toml { };
 
-  python3 = (import sources.nixos-python { }).python311;
-
-  pykanidm = pkgs.callPackage ./packages/pykanidm.nix { inherit python3; };
-  rlm_python =
-    pkgs.callPackage ./packages/rlm_python.nix { inherit python3 pykanidm; };
+  py-pkgs = import ./packages/python { inherit pkgs; };
+  pykanidm =
+    pkgs.callPackage ./packages/pykanidm.nix { inherit (py-pkgs) pydantic; };
+  rlm_python = pkgs.callPackage ./packages/rlm_python.nix { inherit pykanidm; };
 
   cfg = config.services.k-radius;
 in {
diff --git a/machines/compute01/k-radius/packages/pykanidm.nix b/machines/compute01/k-radius/packages/pykanidm.nix
index ac90aed..1a31a00 100644
--- a/machines/compute01/k-radius/packages/pykanidm.nix
+++ b/machines/compute01/k-radius/packages/pykanidm.nix
@@ -1,4 +1,4 @@
-{ lib, fetchFromGitHub, python3 }:
+{ lib, fetchFromGitHub, python3, pydantic }:
 
 let
   pname = "kanidm";
diff --git a/machines/compute01/k-radius/packages/python/01-remove-benchmark-flags.patch b/machines/compute01/k-radius/packages/python/01-remove-benchmark-flags.patch
new file mode 100644
index 0000000..a5c27e4
--- /dev/null
+++ b/machines/compute01/k-radius/packages/python/01-remove-benchmark-flags.patch
@@ -0,0 +1,18 @@
+diff --git a/pyproject.toml b/pyproject.toml
+index 1602e32..507048d 100644
+--- a/pyproject.toml
++++ b/pyproject.toml
+@@ -72,13 +72,6 @@ filterwarnings = [
+ ]
+ timeout = 30
+ xfail_strict = true
+-# min, max, mean, stddev, median, iqr, outliers, ops, rounds, iterations
+-addopts = [
+-    '--benchmark-columns', 'min,mean,stddev,outliers,rounds,iterations',
+-    '--benchmark-group-by', 'group',
+-    '--benchmark-warmup', 'on',
+-    '--benchmark-disable',  # this is enable by `make benchmark` when you actually want to run benchmarks
+-]
+ 
+ [tool.coverage.run]
+ source = ['pydantic_core']
diff --git a/machines/compute01/k-radius/packages/python/default.nix b/machines/compute01/k-radius/packages/python/default.nix
new file mode 100644
index 0000000..805f124
--- /dev/null
+++ b/machines/compute01/k-radius/packages/python/default.nix
@@ -0,0 +1,12 @@
+{ pkgs }:
+
+let
+  inherit (pkgs) lib;
+
+  callPackage = lib.callPackageWith (pkgs // pkgs.python3.pkgs // self);
+
+  self = builtins.listToAttrs (builtins.map (name: {
+    inherit name;
+    value = callPackage (./. + "/${name}.nix") { };
+  }) [ "pydantic" "pydantic-core" ]);
+in self
diff --git a/machines/compute01/k-radius/packages/python/pydantic-core.nix b/machines/compute01/k-radius/packages/python/pydantic-core.nix
new file mode 100644
index 0000000..4569ea3
--- /dev/null
+++ b/machines/compute01/k-radius/packages/python/pydantic-core.nix
@@ -0,0 +1,88 @@
+{ stdenv
+, lib
+, buildPythonPackage
+, fetchFromGitHub
+, cargo
+, rustPlatform
+, rustc
+, libiconv
+, typing-extensions
+, pytestCheckHook
+, hypothesis
+, pytest-timeout
+, pytest-mock
+, dirty-equals
+}:
+
+let
+  pydantic-core = buildPythonPackage rec {
+    pname = "pydantic-core";
+    version = "2.14.5";
+    format = "pyproject";
+
+    src = fetchFromGitHub {
+      owner = "pydantic";
+      repo = "pydantic-core";
+      rev = "refs/tags/v${version}";
+      hash = "sha256-UguZpA3KEutOgIavjx8Ie//0qJq+4FTZNQTwb/ZIgb8=";
+    };
+
+    patches = [
+      ./01-remove-benchmark-flags.patch
+    ];
+
+    cargoDeps = rustPlatform.fetchCargoTarball {
+      inherit src;
+      name = "${pname}-${version}";
+      hash = "sha256-mMgw922QjHmk0yimXfolLNiYZntTsGydQywe7PTNnwc=";
+    };
+
+    nativeBuildInputs = [
+      cargo
+      rustPlatform.cargoSetupHook
+      rustPlatform.maturinBuildHook
+      rustc
+      typing-extensions
+    ];
+
+    buildInputs = lib.optionals stdenv.isDarwin [
+      libiconv
+    ];
+
+    propagatedBuildInputs = [
+      typing-extensions
+    ];
+
+    pythonImportsCheck = [ "pydantic_core" ];
+
+    # escape infinite recursion with pydantic via dirty-equals
+    doCheck = false;
+    passthru.tests.pytest = pydantic-core.overrideAttrs { doCheck = true; };
+
+    nativeCheckInputs = [
+      pytestCheckHook
+      hypothesis
+      pytest-timeout
+      dirty-equals
+      pytest-mock
+    ];
+
+    disabledTests = [
+      # RecursionError: maximum recursion depth exceeded while calling a Python object
+      "test_recursive"
+    ];
+
+    disabledTestPaths = [
+      # no point in benchmarking in nixpkgs build farm
+      "tests/benchmarks"
+    ];
+
+    meta = with lib; {
+      changelog = "https://github.com/pydantic/pydantic-core/releases/tag/v${version}";
+      description = "Core validation logic for pydantic written in rust";
+      homepage = "https://github.com/pydantic/pydantic-core";
+      license = licenses.mit;
+      maintainers = with maintainers; [ blaggacao ];
+    };
+  };
+in pydantic-core
diff --git a/machines/compute01/k-radius/packages/python/pydantic.nix b/machines/compute01/k-radius/packages/python/pydantic.nix
new file mode 100644
index 0000000..18762cc
--- /dev/null
+++ b/machines/compute01/k-radius/packages/python/pydantic.nix
@@ -0,0 +1,96 @@
+{ lib
+, buildPythonPackage
+, fetchFromGitHub
+, pythonOlder
+
+# build-system
+, hatchling
+, hatch-fancy-pypi-readme
+
+# native dependencies
+, libxcrypt
+
+# dependencies
+, annotated-types
+, pydantic-core
+, typing-extensions
+
+# tests
+, cloudpickle
+, email-validator
+, dirty-equals
+, faker
+, pytestCheckHook
+, pytest-mock
+}:
+
+buildPythonPackage rec {
+  pname = "pydantic";
+  version = "2.5.2";
+  pyproject = true;
+
+  disabled = pythonOlder "3.7";
+
+  src = fetchFromGitHub {
+    owner = "pydantic";
+    repo = "pydantic";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-D0gYcyrKVVDhBgV9sCVTkGq/kFmIoT9l0i5bRM1qxzM=";
+  };
+
+  buildInputs = lib.optionals (pythonOlder "3.9") [
+    libxcrypt
+  ];
+
+  nativeBuildInputs = [
+    hatch-fancy-pypi-readme
+    hatchling
+  ];
+
+  propagatedBuildInputs = [
+    annotated-types
+    pydantic-core
+    typing-extensions
+  ];
+
+  passthru.optional-dependencies = {
+    email = [
+      email-validator
+    ];
+  };
+
+  nativeCheckInputs = [
+    cloudpickle
+    dirty-equals
+    faker
+    pytest-mock
+    pytestCheckHook
+  ] ++ lib.flatten (lib.attrValues passthru.optional-dependencies);
+
+  preCheck = ''
+    export HOME=$(mktemp -d)
+    substituteInPlace pyproject.toml \
+      --replace "'--benchmark-columns', 'min,mean,stddev,outliers,rounds,iterations'," "" \
+      --replace "'--benchmark-group-by', 'group'," "" \
+      --replace "'--benchmark-warmup', 'on'," "" \
+      --replace "'--benchmark-disable'," ""
+  '';
+
+  disabledTestPaths = [
+    "tests/benchmarks"
+
+    # avoid cyclic dependency
+    "tests/test_docs.py"
+  ];
+
+  pythonImportsCheck = [ "pydantic" ];
+
+  meta = with lib; {
+    description = "Data validation and settings management using Python type hinting";
+    homepage = "https://github.com/pydantic/pydantic";
+    changelog = "https://github.com/pydantic/pydantic/blob/v${version}/HISTORY.md";
+    license = licenses.mit;
+    maintainers = with maintainers; [ wd15 ];
+  };
+}
+
diff --git a/npins/sources.json b/npins/sources.json
index da6b10d..d8ec8be 100644
--- a/npins/sources.json
+++ b/npins/sources.json
@@ -108,18 +108,6 @@
       "url": "https://releases.nixos.org/nixos/23.11/nixos-23.11.1697.781e2a9797ec/nixexprs.tar.xz",
       "hash": "0c8pky6klmm21m3n659rwa1ls7qk2wjjw2qzxfcagb97kvf5dq58"
     },
-    "nixos-python": {
-      "type": "Git",
-      "repository": {
-        "type": "GitHub",
-        "owner": "NixOS",
-        "repo": "nixpkgs"
-      },
-      "branch": "python-updates",
-      "revision": "16874860fc550ef58f3da5ebb8e4fed9c4a26f21",
-      "url": "https://github.com/NixOS/nixpkgs/archive/16874860fc550ef58f3da5ebb8e4fed9c4a26f21.tar.gz",
-      "hash": "1dfdgvaisbxf39027n671393ly6n5rmjbq1l54ac9jn691kxm0w6"
-    },
     "nixpkgs": {
       "type": "Channel",
       "name": "nixpkgs-unstable",